usb: dwc3: Disable the irq before clearing run_stop bit
Consider a case of quick pull-up disable after pull-up is enabled. If a SETUP packet comes after bus reset event followed by connection done event, there is a possibility of race between composite_dev_cleanup() freeing cdev->req called from configfs_composite_unbind() and composite_setup() storing req pointer to stack. This causes use after free of cdev->req. Fix this issue by disabling the irq before clearing the run-stop bit so that interrupt handling for setup packet is prevented. In order to prevent running bottom half check pullups_connected flag in dwc3_interrupt and ack the generated events and return. Also flush the bottom half work if there was any work pending before disabling dwc3 irq. Change-Id: I979da8536bd6766153e25cf6120f00f348427a72 Signed-off-by:Chandana Kishori Chiluveru <cchiluve@codeaurora.org> Signed-off-by:
Hemant Kumar <hemantk@codeaurora.org>
Loading
Please register or sign in to comment